How to Get Designing for Password Managers Right

Key takeaways

• Autocomplete attributes: tell managers which field is which
• Paste: blocking paste discourages strong passwords
• Most useful single move: Use standard autocomplete attributes.
• Commonest mistake: Blocking paste.
• Bring in help when any of the situations under "When to bring in help" below describe your project.

Why it matters

Password managers improve security, and forms that block them push people toward weak, reused passwords.

The numbers, in one place

The benchmarks here come from the bodies named at the foot of this page.

What good looks like

What follows is the practical part: what the work actually asks of you.

• Use standard autocomplete attributes
• Allow paste in every field
• Keep username and password in one form
• Show password visibility toggles
• Test with common password managers

What to avoid

What to steer clear of, and why it catches teams out.

• Blocking paste
• Splitting passwords into separate boxes
• Custom fields managers cannot detect
• Unnecessary password composition rules

Where this sits in UI & UX Design

Designing for Password Managers is one part of how we approach UI & UX Design work. It rarely arrives on its own: the decisions above interact with everything else on the project, which is why they are worth settling early rather than at review.

Who this is actually for

Most people who end up on a page about Designing for Password Managers got here for a practical reason. A project is about to start, a deliverable came back wrong, or a quote landed and nobody in the room could tell whether it was fair.

Any of those is a fine reason to be here. What follows covers the whole thing: what the work involves, what it costs in the US, how long it takes, what we need from you, and how to tell whether what comes back is any good. Skip to whichever part you need.

When occasional turns into ongoing

There's usually a moment when UI & UX design stops being something you handle between other things and starts being a job. It tends to look like this:

• The work is landing on someone whose actual job is something else, and their actual job is slipping.
• Volume has stopped being occasional and started being weekly.
• Quality varies depending on who happened to be free that day.
• You are turning down opportunities because production cannot keep up.
• The same fix keeps getting made because nobody wrote down how to do it right.
• You are paying for software seats that get used a few days a month.

If two or three of those are true, the question isn't really whether to get help. It's whether to hire, to use a freelancer, or to work with a studio — and there's a section further down that lays out the trade-offs honestly, including the cases where hiring us is the wrong answer.

How the work actually runs

A UI & UX design job runs in stages, and the stages aren't interchangeable. Here they are in the order they have to happen.

1. Understand the job

What are people trying to get done, and what currently stops them. Analytics show where they drop; talking to six of them shows why.

2. Map the flows

Every path through the task, including the ones where something goes wrong. Error states are where most design debt lives.

3. Structure and wireframes

Layout and hierarchy before visual design. Gray boxes, deliberately, so feedback is about structure rather than color.

4. Visual design

Type, color, spacing and components, built as a system rather than as a set of screens.

5. Prototype

Something clickable. A prototype answers questions a static comp cannot, and it answers them before code is written.

6. Test with real people

Five participants find most of the serious usability problems — the finding Nielsen Norman Group published and that has held up for decades. Five, next week, beats twenty next quarter.

7. Handoff

Specs, states, tokens and behavior documented so developers are not reverse-engineering intent from a picture.

8. Measure and iterate

Ship, watch, fix. A design is a hypothesis until real people have used it.

Where does Designing for Password Managers fit? Usually somewhere in the middle of that sequence, and it inherits every decision made before it. That's the argument for settling scope early: a change at stage two is a conversation, and the same change at stage seven is a rebuild.

The numbers, and where they come from

These are published thresholds, not our opinions. Where a standards body or a platform has stated a figure, that figure is here and the body is credited at the bottom of the page. Where nobody has published one, you won't find a number invented to fill the gap.

What it costs in the US

Prices first, because that's what you came for. These are US market ranges for UI & UX design. Your number will land somewhere inside them depending on the factors listed underneath.

Those are wide ranges, and they're wide for a reason. Here's what moves a job from one end to the other.

What actually drives the price

Number of unique flows

Screens are cheap; flows are expensive. Count decisions, not artboards.

Research depth

Expert review is a few days. Moderated testing with recruitment is weeks and has a participant budget.

Design system scope

Designing components once and documenting them costs more up front and less in every subsequent feature.

Existing constraints

Designing inside a legacy system or a fixed component library is faster to build and slower to design well.

Accessibility

Designing to WCAG 2.1 AA from the start adds a little. Auditing and retrofitting adds a lot.

Number of platforms

Web, iOS and Android have different conventions. Pretending otherwise produces something that feels wrong on all three.

How the money is usually structured

Separately from how much, there's the question of how. Five models cover almost everything in this industry, and the right one depends on how well the job can be described before it starts.

Per unit

A fixed price per image, per minute, per page, per asset. Best when the work is genuinely repeatable and you can describe one unit precisely. It is the easiest model to budget and the easiest to argue about, because everything hinges on whether your idea of one unit matches ours. Settle that on a sample before you settle it on an invoice.

Hourly or day rate

You buy time, and the output is whatever that time produces. Honest when nobody can scope the job yet — a rescue, an unknown archive, an exploratory phase. Ask for a not-to-exceed number anyway. An open hourly arrangement with no ceiling is a budget with no floor.

Fixed project fee

One number for a defined scope, usually with a stated number of revision rounds. The model most clients prefer and the one that punishes a vague brief hardest. The fee is only fixed if the scope is, so expect the scope document to be more specific than feels comfortable. That specificity is what protects you.

Monthly retainer

A set amount of capacity reserved for you every month. Worth it once the work is continuous rather than occasional — a catalog that refreshes, a channel that publishes weekly, a site that keeps changing. Below roughly ten to fifteen hours a month it usually costs more than buying the work as it comes.

Value or outcome based

Pricing tied to a business result rather than to effort. Rare, and rarely as clean as it sounds. It works where the outcome is unambiguous and attributable, and falls apart where it is neither. Treat an outcome-based proposal with the same scrutiny you would give any other claim about attribution.

If you want a real number rather than a range, the fastest route is to send us the actual brief — scope, volume, deadline, and a couple of sample files if you have them. That's usually enough for a fixed price rather than an estimate.

How long it takes

The honest version of a schedule. Phases run into each other, and the one that slips is rarely the one people budget extra for.

One thing worth saying plainly: the most common cause of a late project isn't production. It's waiting — for content, for a decision, for one person to look at something. If you want a project to move quickly, the highest-leverage thing you can do is name one person who can say yes and make sure they're available. That single change is worth more than any amount of chasing.

Rush work is possible and it's genuinely more expensive, because it means real people working real overtime or a job jumping a queue somebody else is in. We'll always tell you what a rush actually costs before you commit to it.

What to send us

Everything below is stuff only you know. Getting it down in one place at the start saves more time than anything either of us can do later.

What belongs in the brief

Who it is for

The audience, in one sentence, in your own words. Not a persona document — a sentence.

What it has to do

The action you want someone to take, or the decision you want them to be able to make.

Where it will live

Every placement, at every size. This is the single most common omission, and it is the one that causes reshoots and recrops.

What already exists

Brand guidelines, prior work, the files nobody likes. Especially the files nobody likes, and why.

What is fixed

Colors, typefaces, legal copy, platform requirements, anything that is not up for discussion.

What good looks like

Two or three references, plus one example of something you actively dislike. The dislike is more useful than the likes.

The real deadline

The date something has to be live, not the date you would like to see a draft. Say which one you are giving.

Who signs off

One name. A brief with four approvers and no decider is a brief that will cost you two extra revision rounds.

Two of those deserve emphasis, because they're the ones that cost money when they're missing. Where it will live — every placement, at every size — is the omission that causes reshoots and recrops. And who signs off is the one that quietly adds revision rounds: a project with four approvers and no decider will always cost more than one with a single name on it.

Specific to Designing for Password Managers

On top of the general brief, this particular job benefits from you having settled the following before anyone starts:

• Use standard autocomplete attributes
• Allow paste in every field
• Keep username and password in one form
• Show password visibility toggles

If you've got files ready now, you can send them straight over — they go to private storage rather than to an inbox, and nothing is public. If you'd rather see the standard before committing to anything, try us on a couple of files first. No card, no commitment, and if it's not what you need you've lost nothing but an afternoon.

How to check what comes back

This section is worth reading even if you never hire anybody. Reviewing badly is expensive whoever does the work.

Check it where it will live

Approve a web asset in a browser, a print asset on paper, an audio mix on a phone speaker. Approving a deliverable in the tool that made it is how problems reach the public.

Check the edges, not the middle

The middle is almost always fine. Look at the corners, the smallest size, the longest string, the darkest area, the last ten seconds.

Check one thing at a time

Color, then type, then spacing, then content. A review that tries to see everything at once sees the loudest thing and misses the rest.

Collect feedback before you send it

One consolidated list beats six emails. Contradictions inside your own organization are cheaper to resolve on your side than on ours.

Be specific about what is wrong

"Make it pop" costs a revision round. "The headline is hard to read against the sky, can we darken the area behind it" costs ten minutes.

Say what is right too

Not out of politeness. If you only flag problems, the next round can lose the thing you liked without anyone knowing it mattered.

The bar we hold ourselves to

So you know what you're measuring against, here's what gets checked on our side before anything reaches you. None of it is optional, and none of it is charged as an extra.

• Every interactive element reachable by keyboard, with a visible focus state
• Contrast checked at 4.5:1 for body text and 3:1 for large text and interface components
• Touch targets large enough to hit reliably — around 44 points is the common platform guidance
• Every state designed, not just the happy one: empty, loading, error, too much content
• Tested with real content, including the longest name and the emptiest account
• Behavior documented for developers rather than implied by a static image

Red flags specific to Designing for Password Managers

If you see any of these in what comes back, say so. They're all fixable, and they're all cheaper to fix now than after it's published.

• Blocking paste
• Splitting passwords into separate boxes
• Custom fields managers cannot detect
• Unnecessary password composition rules

You can see how we present finished work — including the before and after — in the portfolio. Anything marked as a sample is our own demonstration piece rather than a client project, and it says so on the item.

Three situations you might recognize

Abstract advice is easy to agree with and hard to use. These are the shapes this kind of problem actually arrives in, and what we'd do about each one.

A checkout that lost people at step three

Analytics showed the drop; five moderated sessions showed why. The shipping cost appeared for the first time on that step, and people left to check whether it was normal. Showing it earlier recovered most of them.

A design system nobody used

It existed as a beautiful file with no documentation, no tokens in code and no owner. Rebuilding it around tokens the developers could actually consume, with a named maintainer, is what made it real.

An interface that failed an accessibility audit late

Contrast and focus states were not considered during design, so the audit findings landed in engineering as rework. On the next project the same checks took minutes in the design file.

None of those needed heroics. They needed somebody to look at the right thing early, which is most of what experience buys you in this field.

In house, freelance, studio, or a model?

This is the decision underneath "how much does it cost", and it deserves a straight answer rather than a pitch. There are four ways to get UI & UX design work done, and we're only the right choice for some of them.

Keep it in house

Someone on your payroll does it.

What's good about it: Fastest feedback loop there is, deepest product knowledge, no briefing overhead for small changes.

What's not: You are buying a person, not a job: their vacation, their sick days, their ceiling, and the software. It stops making sense the moment demand is spiky, because you pay for the peak all year.

Hire a freelancer

One specialist, engaged directly.

What's good about it: Cheapest way to buy real expertise, and you get the actual person who does the work.

What's not: One person is one point of failure. No cover, limited throughput, and if they move on mid-project you inherit their files and their conventions.

Use a studio

A team with a process, a review layer and cover.

What's good about it: Handles volume and variety, carries the QC step, and does not disappear when one person is sick.

What's not: More expensive per hour than a freelancer, and you are one client among several. Worth it when consistency across a lot of output matters more than the lowest rate.

Use a model

Generative or automated tooling, with or without a person checking.

What's good about it: Genuinely fast and genuinely cheap on the parts it is good at, and it does not get tired on page four hundred.

What's not: It is confidently wrong in ways that are hard to spot at a glance, and the parts it fails at are the ones a client notices: hands, text, counts, edges, continuity. Nothing should ship without a person having looked at it, which is why our AI work is priced with the review included rather than as a discount.

The short version: if the work is constant and central to what you do, hire. If it's spiky, or it needs a range of skills you can't justify employing, use a studio. If it's one specialist thing and you've found the right specialist, use them. We'd rather tell you that up front than take on a job we're the wrong shape for.

The US rules worth knowing

This isn't legal advice and we're not lawyers. It's a list of the American rules that come up often enough in this kind of work that not knowing about them gets expensive. If any of it applies to you, it's worth twenty minutes with someone who is a lawyer.

ADA and Section 508

Web accessibility claims under the Americans with Disabilities Act are common in the United States, and federal agencies and their contractors are bound by Section 508, which points at WCAG. Design decisions — contrast, focus states, target size — are where most of it is either satisfied or lost.

Dark patterns

The Federal Trade Commission and several state attorneys general have taken action over interface designs that obscure costs, trick people into subscriptions, or make cancellation deliberately hard. Negative-option and auto-renewal flows are a specific area of enforcement attention.

Accessible forms and error handling

Labeling, error identification and instructions are explicit WCAG success criteria, and forms are where accessibility complaints concentrate — because a form that cannot be completed is a service that cannot be used.

And the general commercial stuff

Whatever the discipline, buying professional services in the United States raises the same handful of questions. These are the ones clients ask us most.

Contracts and statements of work

A statement of work that names the deliverables, the number of revision rounds, the ownership terms and the payment schedule is worth the hour it takes to read. Most disputes in this industry are not about quality; they are about two people having understood "done" differently.

Ownership and work made for hire

Under US copyright law, work created by an independent contractor generally belongs to the contractor unless there is a written assignment or it falls into one of the narrow statutory work-made-for-hire categories. That surprises a lot of buyers. Get the assignment in writing; any studio that hesitates is telling you something useful.

Paying an outside supplier

A US business paying a US contractor normally collects a Form W-9 and may need to file a 1099-NEC; paying a non-US supplier usually means a W-8BEN or W-8BEN-E instead. Your accountant will want these before the first invoice, not after the last one.

Sales tax on services

Whether a creative or digital service is taxable varies by state, and several states tax some digital deliverables and not others. It is worth one question to your accountant before a large engagement rather than one letter from a state revenue department after it.

Advertising claims

The Federal Trade Commission holds advertisers responsible for claims made in their marketing, including claims made in images. A retouched product photo that no longer represents the product is an advertising problem before it is a design one, and the liability sits with the advertiser rather than the retoucher.

Accessibility

Title III of the Americans with Disabilities Act has been read by US courts to cover websites in many circumstances, and federal agencies and their contractors are bound by Section 508, which points at WCAG. Accessibility is cheaper designed in than litigated out.

Our own terms are published rather than sent on request: you can read the terms and conditions, the payment terms, the refund policy and the confidentiality and NDA position before you talk to anybody. If something in them doesn't work for you, say so early — most of it is negotiable and all of it is better settled before the work than after it.

Questions to ask anyone quoting for this

Including us. If a supplier gets cagey about any of these, that's the answer to the question you were actually asking.

Who is actually doing the work?

Ask whether it stays with the person you are talking to, moves to a team, or gets subcontracted. None of those is wrong. Not knowing is.

What exactly is a revision?

Ask what counts as a revision versus a new brief, and how many are included. This is the single most common source of a bill you did not expect.

Who owns the output?

Get it in writing, including the working files. "You own the final" and "you own everything" are very different positions, and the second one costs more for a reason.

What happens if it is wrong?

Ask what a redo costs and how fast it happens. A studio with a clear answer has had the conversation before.

Can I see work like mine?

Not a showreel — work in your category, at your volume, with the constraints you have. A beautiful portfolio in another category proves taste, not fit.

How do you handle my files?

Where they are stored, who can reach them, how long they are kept, and what happens at the end. If you are sending anything unreleased, get this in the contract.

What do you need from me?

A supplier who cannot answer this has not thought about your side of the job, and you will discover that at the deadline.

One more, and it's the one people are most embarrassed to ask: what would make you turn this job down? A studio that has never turned work away is a studio that takes everything, and that tells you something about how carefully it's going to be handled.

The words people will use at you

Every field has vocabulary that gets deployed as a shortcut and lands as a barrier. Here's what the common terms in UI & UX design actually mean, in plain English. You shouldn't need this to buy the work, but it makes the conversation shorter.

Information architecture

How content is organized and labeled so people can find it. The structure under the design.

Wireframe

A layout without visual styling, used to agree structure before anyone argues about color.

Prototype

A clickable simulation. The cheapest way to find out whether a flow works.

Design system

Components, tokens and rules used across a product, so the fifth screen costs less than the first.

Design token

A named value — a color, a spacing step — defined once and used everywhere, so a change is one edit.

Heuristic evaluation

An expert walkthrough against established usability principles. Fast, cheap, and no substitute for watching real users.

Affordance

A visual cue that tells you what something does. The reason a button should look pressable.

Cognitive load

How much someone has to hold in their head to get through a task. Usually the real problem behind "it feels complicated".

Progressive disclosure

Showing the common options first and the rest on request, rather than everything at once.

Empty state

What a screen looks like with no data. The first thing every new user sees, and the last thing most teams design.

There's a fuller reference library if you want to go deeper on any of these, and everything in it is written the same way — plainly, with sources.

Questions people ask before hiring

These are the ones that come up on almost every inquiry about Designing for Password Managers, answered straight. If yours is not here, ask it — nobody will put you on a mailing list for it.

How much does this cost?

US market rates for designing screens and flows so people can actually finish what they came to do start around $2,000 – $8,000 for the simplest work and climb from there with complexity, volume and turnaround. We price per project once we have seen the brief, because a number quoted without looking at the files is a number that changes later.

Can you give me a fixed price?

Usually, yes — once the scope is written down. A fixed price needs a fixed scope, so expect the scope document to be more specific than feels necessary. That specificity is what protects you from a variation invoice.

How quickly can you start?

Understand and map normally takes 1–3 weeks. How soon that starts depends on the queue, and we will tell you the real date rather than the one you want to hear.

What do you need from me to begin?

A brief, the files, and the name of the one person who can approve things. The third one matters more than people expect: projects with a single decider finish measurably faster than projects with a committee.

Who owns the finished work?

You do, including the working files, and it is written into the terms rather than left to be assumed. Under US copyright law work by an outside contractor does not transfer automatically without a written assignment, so this is worth checking with any supplier.

What if I do not like it?

Tell us specifically what is wrong and we will fix it. Revision rounds are stated in the quote so nobody is guessing. If the standard is genuinely not what you need, the refund policy says what happens, in writing, before you spend anything.

Do you work with US clients?

Yes, and the hours overlap the US business day. Pricing is in US dollars, deliverables are specified against the American standards that apply — ATSC, the ADA and Section 508, FTC advertising rules, US marketplace requirements — rather than the European equivalents that a lot of studios default to.

Can I try before committing?

Yes. Send a couple of real files and we will do the work to your brief, free, with no card and no commitment. It is a better test than any portfolio, because it is your material and your standard.

Is my material kept confidential?

Yes. Files go to private storage rather than to an inbox, nothing is published without your say-so, and we will sign your NDA or use ours, whichever you prefer.

What is the most common reason a project like this runs late?

Waiting for a decision. Not production, not revisions — waiting. If you take one thing from this page, make it that.

Where to go next

• Passkeys and Passwordless Sign-In: The Decisions That Matter
• Cookie Banner Design: The Decisions That Matter

When to bring in help

Bring in help when sign-in problems cause support tickets.

Where this comes from

• MDN Web Docs — The autocomplete attribute
• National Cyber Security Centre — Password policy

How this page was put together

Every figure, practice and warning above is taken from the standards, platform documentation and published research named in Where this comes from. Nothing here is inferred or generalized beyond what those bodies publish: where they give a number, it is their number, and where they are silent, so are we. Pages are rebuilt whenever the underlying record changes. Our own opinions, where we have them, live in the case studies and are signed.

Working on something like this?

We take on UI & UX Design work for teams who want it done once, properly. Tell us what you are building and we will tell you honestly whether we are the right studio for it. Start a project.

More useful paths

Use these paths to continue with the closest practical topic, service, or decision guide.

• UI & UX Design article library
• Designing for Trust, Done Properly
• Designing for Older Adults, Done Properly
• How to Get Designing with Real Content Right
• How to Get Identity Verification UX Right
• Dedicated Growth Team vs Hire Paid Media Manager